South Carolina recently became the first state to adopt the National Association of Insurance Commissioners' (NAIC) Insurance Data Security Model Law. The NAIC is a standard-setting and regulatory support organization consisting of the top insurance regulators from the 50 states, District of Columbia, and five U.S. territories. The NAIC formally adopted the model law in October 2017. The model law is similar but not identical to the New York Department of Financial Services' cybersecurity rules applicable to banks, insurance companies and other financial services companies, 23 NYCRR 500, that went into effect on March 1, 2017. A drafter's note to the model law indicates that someone in compliance with the New York cyber rules is in compliance with the model law. South Carolina adopted the model law nearly verbatim as the South Carolina Insurance Data Security Act, which will become effective Jan. 1, 2019. The Data Security Act makes no reference to the New York cyber rules and it remains to be seen how South Carolina will treat companies that are already subject to the New York cyber rules. The most likely way in which this will be addressed would be through regulations adopted pursuant to the Data Security Act.

Two of the biggest questions when the model law was adopted were how widely and how uniformly the model law would be implemented by the states. That remains to be seen as currently only one other state, Rhode Island, is considering whether or not to adopt the model law. However, a number of other states are considering legislation involving insurance companies and some aspect of data privacy including Georgia, Illinois, Kentucky, Maryland and Virginia among others, which further increases the prospect of a patchwork of competing and possibly conflicting cybersecurity requirements.

Both the New York cyber rules and the Data Security Act are based on a risk management approach to cybersecurity. This approach, which is also the basis for the NIST cybersecurity framework, is widely regarded as a best practice approach to cybersecurity. What is still very much in question is the ability of regulations of this type to actually improve cybersecurity. As both the Data Security Act and New York cyber rules tacitly acknowledge there is no perfect answer or approach to cybersecurity. Security measures that would be commonplace for large companies will often not fit smaller companies and vice versa. Examples include the frequency and sophistication of penetration and other testing methods and the scope and intensity of employee training. Given that it is widely understood by security experts that everybody is vulnerable, even those with the most robust cybersecurity, it still remains to be seen what impact these regulations will have.

The New York cyber rules apply to “covered entities” that are defined to include any person operating under or required to operate under a license, registration, charter, or similar authorization under New York's Banking, Insurance or Financial Services Laws, 23 NYCRR 500.01. The New York cyber rules impose a number of requirements on covered entities including: maintaining a cybersecurity program; maintenance of a written policy or policies detailing the steps to be taken to protect information systems; designation of a CISO who is to provide at least annual reports to the board of directors or equivalent governing body; to conduct periodic penetration testing and vulnerability assessments; the ability to reconstruct material financial transactions and maintenance of audit trails designed to detect and respond to cybersecurity events; limitation of access to nonpublic information; specific guidelines for the creation of in-house developed applications and evaluation of externally created applications; conduct periodic risk assessments sufficient to enable the creation of a cybersecurity program required under the New York cyber rules; utilize qualified cybersecurity personnel to perform or oversee the performance of core cybersecurity functions; implement written policies and procedures for interaction with third party service providers (500.11); utilization of multifactor and risk-based authentication; limitations on data retention; monitoring activity by authorized users to develop risk-based controls to prevent unauthorized use or access by such users and regular cybersecurity awareness training for all personnel that is updated to reflect risks identified in the risk assessment; encryption of nonpublic information in transit over external networks and at rest; establish written incident response plan; and, notice to the superintendent within 72 hours of determining that a cybersecurity event occurred and annual certification of compliance to the superintendent.

The Data Security Act requires licensees to implement a comprehensive written information security program based on a mandated risk assessment. As part of the information security program the licensee must designate an individual (who can come from a third party) to be responsible for the information security program. The risk assessment must identify reasonably foreseeable internal and external threats to nonpublic information including any information systems or nonpublic information that are controlled or accessible by third-party service providers; assess the likelihood and severity of damage by these potential threats; assess the sufficiency of existing policies, procedures, and technology in place to protect against such threats; and, implement information safeguards to manage the identified threats and at least annually assess their effectiveness. There is emphasis on assessing the licensees' policies, procedures, information systems and safeguards with respect to: employee training and management; information systems including information classification, governance, processing, storage, transmission and disposal; and, detecting, preventing, and responding to attacks, intrusions, or other system failures.

The Data Security Act requires licensees to perform continuing risk management with respect to cybersecurity issues. A licensee, commensurate with its size and complexity of activities, shall design its information security programs to mitigate the risk identified in the risk assessment. At a minimum a licensee must evaluate the appropriateness of implementing 11 enumerated security measures including implementing access controls with authentication on information systems, restricting access at physical locations with nonpublic information, encryption, and to regularly test and monitor systems and procedures to identify actual and attempted attacks or intrusions. Licensees must also include cybersecurity risks in their enterprise risk management process, stay informed regarding emerging threats and vulnerabilities, and provide its personnel with cybersecurity awareness training as necessary to reflect risks identified in the risk assessment. Oversight of the information security program is required by a licensee's board of directors, if applicable. Other responsibilities include oversight of third-party service providers, ongoing monitoring, evaluation, and adjustment as necessary of the information security program, establishment of a written incident response plan, and annual certification of compliance with Section 4 to the insurance commissioner.

The Data Security Act also contains detailed provisions regarding the investigation of and notification regarding cybersecurity events. Licensees must investigate whenever there is or may have been a cybersecurity event. The investigation can be performed by an outside vendor on behalf of the licensee. There are separate notification requirements for the commissioner, consumers and reinsurers. The director of the department of insurance has the authority to investigate a licensees' compliance with the Data Security Act and to take action to enforce the Data Security Act. Importantly, the Data Security Act provides for confidentiality of information provided by a licensee or obtained by the director in an investigation or examination. The Data Security Act expressly provides that these documents are not subject to freedom of information act or similar laws, subpoenas, or discovery in civil actions and are inadmissible in civil actions.

Both the Data Security Act and New York cyber rules have staged implementation. New York just recently passed the third of four compliance dates with the only remaining item related to third-party vendors, which is due in March 2019. South Carolina has two implementation dates as of July 1, 2019, for everything required under 38-99-20 except for third-party vendor compliance under 38-99-20 (F), which is not due until July 1, 2020.

While it is hard to argue with the intent of the Data Security Act and New York cyber rules in seeking to promote robust cybersecurity it is debatable how effective they will be. Federal regulations governing cybersecurity have been in place for some time, most notably the Health Insurance Portability and Accountability Act and Gramm-Leach-Bliley Act, for the health care and financial industries, respectively, and high-profile breaches still occur regularly in those industries. One of the biggest issues is how quickly the threat environment adapts and evolves. What works today can easily be outdated tomorrow. Can legislatures (statutes) and insurance departments (regulations) really keep pace? It will also be interesting to see what, if any, impact the insurance industries' experience in complying with these requirements will have on the cyberinsurance market, which is still a new an evolving market with little to no standardization in coverages between insurance companies.

Christopher M. Brubaker of Clark Hill concentrates his practice in complex commercial litigation and insurance matters. He regularly provides advice to companies on insurance and cyberrisk issues related to transactions and risk management and also advises companies on regulatory matters involving insurance and environmental laws, rules and regulations. He frequently speaks and writes on cybersecurity matters for legal and professional groups.